Microsoft grows EU cloud localization services

Microsoft announced Thursday that it will provide upgraded cloud computing services that keep data within the European Union as part of an effort to comply with stricter overseas privacy regulations.

The tech giant’s modifications affect a range of offerings, such as Azure, Microsoft 365, Power Platform, and Dynamics 365. The upgrades build on earlier updates to meet EU regulations set last year, which included the storage of automated system logs. Microsoft has stated that it is “the first major cloud provider to offer this degree of data residency” to European customers.

“With today’s update, Microsoft takes another decisive step in expanding its suite of trusted cloud services that respect European values and meet the specific requirements of our commercial and public sector customers in Europe,” Microsoft said in a statement.

Amid increasingly stringent data privacy laws in the 27-country EU, cloud computing firms are shifting towards localizing data storage and processing.

“Governments are enacting regulations to control the flow and storage of data within their borders, and arming these regulations with huge associated penalties and fines to protect their citizens’ data, and as a flow on effect, boost their local technology sectors,” said Claude Mandy, Chief Evangelist, Data of Symmetry Systems, which provides cloud security. “The size of these penalties makes it impossible for global cloud providers to ignore.”

The Snowden Effect

Brussels and Washington have been discussing for a long time how to keep data from EU citizens safe when American tech companies store it. The action is in response to disclosures by Edward Snowden, a former employee of the National Security Agency, who exposed that the U.S. government was surveilling online data and communications.

The EU aims to guarantee that data stored in the cloud is safe from possible surveillance or meddling by foreign governments, said Randy Shore, the vice president of delivery and support at the cloud vendor Kion.

“As the three big hyperscalers are all American companies, data sovereignty is designed to help build trust that EU governments and businesses won’t be susceptible to U.S. intelligence/security infiltration if they choose to host secret or confidential data in the cloud and won’t be subject to foreign laws or policies when accessing, storing, or using their data,” Shore added.

A significant concern is that a government could spy on or seize information from an entity in a different country if the data is processed on servers located in the government’s country, said Jackie McGuire, a senior security strategist at Cribl. For example, a French company using AWS to store data could potentially have that data seized under the U.S. under the FISA or Cloud Act laws.

Keeping Data Local

Microsoft started last year to keep and handle some data in Europe. The company is now expanding this service to cover all personal data, including anonymized details in system logs automatically made when online services are used.

By the end of this year, Microsoft also plans to keep all technical support data in Europe. The company is also considering offering a paid service for tech support that starts in the EU. In a similar move, Amazon set up its own cloud infrastructure in the E.U. last year to comply with the tough rules that affect companies and government agencies.

However, there may be limits to providing local cloud services. McGuire said it’s not feasible to build data centers in every country and jurisdiction, nor would it be wise to give up the redundancy that a distributed network like AWS offers.

“If a natural disaster or war impacts the only data center in a small European country and they’re legally prohibited from reverting to another compute region, the consequences could be devastating,” McGuire added.